Messages

I got 4 static ip's  and single gateway is it possible to use failover/load balance for them?
Router have wan/lan ports only and it's virtualized in proxmox with added few virtual nics (attached to actuall WAN interface).
Problem is that when i create like 2/3 WAN interfaces with static ip , gateway is already used from the first one.
Can you give me some tips how ot achieve this ?
Thanks in advance

Also very interested in this, specifically for watching requests and their api's for debugging.
For me solution for now is mitmproxy virtualized on proxmox *in regular mode* - transparent not works for me https://github.com/mitmproxy/mitmproxy/discussions/6338

Hellow gentlemens, still learning here need some help, because I think i saw something strange in watching my logs.
First is is possible somehow to disable rules that are hardcoded for ipv6 somehow and is it a good idea? ( also can i remove ipv6 from loopback routes ?)
Second i follow a guide to disable ipv6 for firewall but i still see it sometimes in loopback in example even i'am sure i disable it right.
And also on rules picture isn't this duplicating?
Thanks in advance.

Please don't report issues to us reported by the security health check, they are already known and highly likely a fix is pending for the next release.https://docs.opnsense.org/security.html
I was reporting once like you guys than readed docs, and I still do

Everything works for me but i tried to check some logs and saw something, Is this normal output when enable Detailed logging in 1_HTTPS_frontend, also if this is expected is there a way to keep the logging and disable this output somehow ?

Code Select Expand

2023-03-07T20:39:05 Error haproxy 192.168.1.102:47192 [07/Mar/2023:20:39:05.886] 1_HTTPS_frontend~ ADGUARD_backend/ADGUARD_server 0/-1/-1/-1/0 -1 0 - - CR-- 2/1/0/0/0 0/0 "GET https://adguard.xxx.yyy/assets/favicon.png HTTP/2.0"
2023-03-07T20:35:04 Error haproxy 3.252.130.46:37184 [07/Mar/2023:20:35:04.759] 1_HTTPS_frontend~ 1_HTTPS_frontend/<NOSRV> -1/-1/-1/-1/0 503 217 - - SC-- 4/2/0/0/0 0/0 "GET / HTTP/1.0"
2023-03-07T20:31:32 Error haproxy 192.168.1.102:47192 [07/Mar/2023:20:31:32.228] 1_HTTPS_frontend~ PROXMOX_backend/PROXMOX_server 0/0/0/-1/2 -1 0 - - CD-- 2/1/0/0/0 0/0 "GET https://proxmox.xxx.yyy/pve2/ext6/theme-crisp/resources/images/grid/hd-pop.png HTTP/2.0"
2023-03-07T20:31:03 Error haproxy 192.168.1.102:47192 [07/Mar/2023:20:31:03.640] 1_HTTPS_frontend~ PROXMOX_backend/PROXMOX_server 0/0/0/3/3 501 197 - - ---- 2/1/0/0/0 0/0 "GET https://proxmox.xxx.yyy/images/logo-ceph.png HTTP/2.0"

2023-03-07T20:31:00 Error haproxy 192.168.1.102:47212 [07/Mar/2023:20:31:00.634] 1_HTTPS_frontend/127.4.4.3:443: SSL handshake failure
2023-03-07T20:31:00 Error haproxy 192.168.1.102:47217 [07/Mar/2023:20:31:00.659] 1_HTTPS_frontend/127.4.4.3:443: SSL handshake failure
2023-03-07T20:31:00 Error haproxy 192.168.1.102:47214 [07/Mar/2023:20:31:00.649] 1_HTTPS_frontend/127.4.4.3:443: SSL handshake failure

And can someone post some implementation screenshots of NOSSLservice_rule

Hellow, i'am using proxmox and opnsense as VM. I have few vlans but one in particular is giving me strange error screenshoted bellow.
Network setup ::::> Proxmox *vmbr0-for proxmox static ip*, vmbr1 WAN(opnsnse) , vmbr2 (LAN opnsnse).
Opnsense have few vlans ( 10,20,30,40 ) where 40 is for VM's
One of VM's is AdguardHome as DNS and additionally i set this dns (192.168.40.2) on all interfaces LAN,Guests,IOT,etc.

Also i have setup STATIC ip's for specific VM's on vlan40


FIXed with:
Manually set 192.168.40.2/32 and gateway 192.168.40.1 on VM's..

Thanks for the detailed explanation ! + karma

I saw in few places that haproxy is only tcp/http proxy, today i tried to setup RustDesk host and everything except that hbbs - RustDesk ID/Rendezvous server ( https://rustdesk.com/docs/en/self-host/install/ ) works so far.
I get that 21116 is UDP and maybe will be not possible to reverse proxy this but i need to ask is there a way to get it working ?

Another question is there a way to make range of port like 21115-21117 because adding some services may make the UI little overcrowded in time

Found this lovely guide: https://labzilla.io/blog/force-dns-pihole
On first try manage to lock myself , but i think its working we will see :)

Thank you Sir!

Hellow gentlemens, what is the best way to disable NTPD in freebsd so it doesn't auto load when [machine] is booted/rebooted, so i can just enable Chrony and put it on 123 port?
Can i just delete/move /etc/rc.d/ntpd or this is not the way?

Totally my mistake of course, i somehow manage to confuse myself to put in map file xkp XKP_Server, instead of xkp XKP_backend, damn i did this tutorial 3 times already today to realize it.
Also forgot in ACME , OCSP must staple.
So far everything works.

Strange but 503 error appear to me as well.
I tested with apache,nodejs,wamp nothing worked. They i try to redirect to my switch to see if my windows is not the problem... but nope.
DynamicDNS is configured and working fine,
All gui redirections disabled and opnsense gui port changed.
Added firewall rule to WAN , and no additional LAN rules added ( it's almost fresh install )
Acme - generated fine cert via dns. ( 2/4/2023, 7:23:39 PM   OK   2/4/2023, 7:23:40 PM )


Tested from external network via smartphone on cellular data.

One thing is that i am using proxmox to virtualize opnsense as "routerOnStick/Forbidden Router" and i pass two ports from quad NIC on promox-server as LAN/WAN for opnsense , and lan is going to dumb switch that transfer vlans/lan to rest of my house , so far not a single problem with that but maybe just maybe..

Code Select Expand

OPNsense 23.1_6-amd64
FreeBSD 13.1-RELEASE-p5
OpenSSL 1.1.1s 1 Nov 2022

Code Select Expand

HAProxy version 2.6.7-c55bfdb 2022/12/02 - https://haproxy.org/
Status: long-term supported branch - will stop receiving fixes around Q2 2027.
Known bugs: http://www.haproxy.org/bugs/bugs-2.6.7.html
Running on: FreeBSD 13.1-RELEASE-p5 FreeBSD 13.1-RELEASE-p5 stable/23.1-n250372-c4ad069e50a SMP amd64

Code Select Expand

#
# Automatically generated configuration.
# Do not edit this file manually.
#

global
    uid                         80
    gid                         80
    chroot                      /var/haproxy
    daemon
    stats                       socket /var/run/haproxy.socket group proxy mode 775 level admin
    nbthread                    4
    hard-stop-after             60s
    no strict-limits
    maxconn                     10000
    tune.ssl.default-dh-param   4096
    spread-checks               2
    tune.bufsize                16384
    tune.lua.maxmem             0
    log                         /var/run/log local0 info
    lua-prepend-path            /tmp/haproxy/lua/?.lua

defaults
    log     global
    option redispatch -1
    maxconn 5000
    timeout client 30s
    timeout connect 30s
    timeout server 30s
    retries 3
    default-server init-addr last,libc

# autogenerated entries for ACLs


# autogenerated entries for config in backends/frontends

# autogenerated entries for stats




# Frontend: 0_SNI_frontend (Listening on 0.0.0.0:443 and 0.0.0.0:80)
frontend 0_SNI_frontend
    bind 0.0.0.0:443 name 0.0.0.0:443
    bind 0.0.0.0:80 name 0.0.0.0:80
    mode tcp
    default_backend SSL_backend

    # logging options
    option log-separate-errors
    option tcplog

# Frontend: 1_HTTP_frontend (Listening on 127.4.4.3:80)
frontend 1_HTTP_frontend
    bind 127.4.4.3:80 name 127.4.4.3:80 accept-proxy
    mode http
    option http-keep-alive
    option forwardfor

    # logging options
    option log-separate-errors
    option httplog
    # ACL: NoSSL_condition
    acl acl_63dea06740dee5.93056632 ssl_fc

    # ACTION: HTTPtoHTTPS_rule
    http-request redirect scheme https code 301 if !acl_63dea06740dee5.93056632

# Frontend: 1_HTTPS_frontend (Listening on 127.4.4.3:443)
frontend 1_HTTPS_frontend
    http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    bind 127.4.4.3:443 name 127.4.4.3:443 accept-proxy ssl curves secp384r1  no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-GCM-SHA384 ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 alpn h2,http/1.1 crt-list /tmp/haproxy/ssl/63dea303583a84.37941891.certlist
    mode http
    option http-keep-alive
    option forwardfor
    timeout client 15m

    # logging options
    option log-separate-errors
    option httplog

    # ACTION: PUBLIC_SUBDOMAINS_map-rule
    # NOTE: actions with no ACLs/conditions will always match
    use_backend %[req.hdr(host),lower,map_dom(/tmp/haproxy/mapfiles/63dea0bbafdf17.31648976.txt)]

# Backend: SSL_backend ()
backend SSL_backend
    # health checking is DISABLED
    mode tcp
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    server SSL_server 127.4.4.3 send-proxy-v2 check-send-proxy

# Backend: XKP_backend ()
backend XKP_backend
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    http-reuse safe
    server XKP_server 192.168.1.104:80 ssl verify none



# statistics are DISABLED

Code Select Expand

2023-02-05T10:45:38 Error haproxy ********:31073 [05/Feb/2023:10:45:38.668] 1_HTTPS_frontend~ 1_HTTPS_frontend/<NOSRV> -1/-1/-1/-1/0 503 217 - - SC-- 2/1/0/0/0 0/0 "GET https://[********:/favicon.ico HTTP/2.0"

Code Select Expand

root@firewall:~ # haproxy -f /usr/local/etc/haproxy.conf -d
Available polling systems :
     kqueue : pref=300,  test result OK
       poll : pref=200,  test result OK
     select : pref=150,  test result FAILED
Total: 3 (2 usable), will use kqueue.

Available filters :
        [CACHE] cache
        [COMP] compression
        [FCGI] fcgi-app
        [SPOE] spoe
        [TRACE] trace
Using kqueue() as the polling mechanism.
00000000:0_SNI_frontend.accept(0004)=0014 from [********:31207] ALPN=<none>
00000001:1_HTTPS_frontend.accept(0007)=0017 from [********:31207] ALPN=h2
00000001:1_HTTPS_frontend.clireq[0017:ffffffff]: GET https://********/ HTTP/2.0
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: host: ********
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: cache-control: max-age=0
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-ch-ua-mobile: ?1
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-ch-ua-platform: "Android"
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: save-data: on
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: dnt: 1
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: upgrade-insecure-requests: 1
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: user-agent: Mozilla/5.0 (Linux; Android 13; Mi 9T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-fetch-site: cross-site
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-fetch-mode: navigate
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-fetch-user: ?1
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-fetch-dest: document
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: accept-encoding: gzip, deflate, br
00000001:1_HTTPS_frontend.clihdr[0017:ffffffff]: accept-language: en-US,en;q=0.9
00000001:1_HTTPS_frontend.clicls[0017:ffff]
00000001:1_HTTPS_frontend.closed[0017:ffff]
00000002:1_HTTPS_frontend.accept(0007)=0017 from [********:31207] ALPN=h2
00000002:1_HTTPS_frontend.clireq[0017:ffffffff]: GET https://********/favicon.ico HTTP/2.0
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: host: ********
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: dnt: 1
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-ch-ua-mobile: ?1
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: save-data: on
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: user-agent: Mozilla/5.0 (Linux; Android 13; Mi 9T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-ch-ua-platform: "Android"
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-fetch-site: same-origin
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-fetch-mode: no-cors
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: sec-fetch-dest: image
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: referer: https://********/
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: accept-encoding: gzip, deflate, br
00000002:1_HTTPS_frontend.clihdr[0017:ffffffff]: accept-language: en-US,en;q=0.9
00000002:1_HTTPS_frontend.clicls[0017:ffff]
00000002:1_HTTPS_frontend.closed[0017:ffff]
00000000:SSL_backend.srvcls[0014:ffff]
00000000:SSL_backend.clicls[ffff:ffff]
00000000:SSL_backend.closed[ffff:ffff]


Code Select Expand

Interesting is that from opnsense ssh via wget i managed to download from server, and from windows too..
wget --save-headers http://ccc.network.ccc
This was with DNS override , but still not accessible by browser

image - https://i.ibb.co/bL8Wgbj/34.png

Yeah Sir i still don`t use it i must read carefully the docs and consider if i need it for security.
Thanks for patch and for good work !

Opnsense-devel   /usr/local/etc/rc.bootup: The command '/usr/local/etc/rc.d/strongswan onestop' returned exit code '1', the output was 'strongswan not running? (check /var/run/daemon-charon.pid).'

System is upgraded from stable to devel